The first quantum money scheme was proposed by Wiesner [1]} around 1970. The idea was to represent banknotes using quantum states which, by the laws of quantum mechanics, would be impossible to copy. Wiesner's scheme, which is nowadays called a private-key quantum money scheme, worked as follows. The bank generates a pair \((s, \rho _s)\)  consisting of a classical serial number \(s\)  and a quantum state \(\rho _s\) , and stores \(s\)  along with a classical description of \(\rho _s\)  in a database. Without access to the database, no algorithm would be able to copy \(\rho _s\)  with non-negligible probability. Therefore, only the issuing bank would be able to verify the banknotes. Although this scheme is information-theoretically secure, it suffers major drawbacks in terms of practicality: First, the issuing bank has to maintain a huge database containing classical descriptions of every banknote ever produced. Second, only the bank can verify a banknote, and therefore the users have to take the money back to the bank for every transaction.
